CVE-2025-0684: Out-of-bounds Write
A flaw was found in grub2. When performing a symlink lookup from a reiserfs filesystem, grub's reiserfs fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the grub_reiserfs_read_symlink() will call grub_reiserfs_read_real() with a overflown length parameter, leading to a heap based out-of-bounds write during data reading. This flaw may be leveraged to corrupt grub's internal critical data and can result in arbitrary code execution, by-passing secure boot protections.
AI Analysis
Technical Summary
The vulnerability in grub2 occurs when performing a symlink lookup on a reiserfs filesystem. The module uses user-controlled filesystem geometry parameters to calculate buffer sizes but fails to properly check for integer overflows. This can cause grub_malloc() to allocate a smaller buffer than expected. Subsequently, grub_reiserfs_read_symlink() calls grub_reiserfs_read_real() with an overflowed length parameter, resulting in a heap-based out-of-bounds write during data reading. Exploitation could lead to corruption of critical grub data and arbitrary code execution, bypassing secure boot.
Potential Impact
Successful exploitation allows an attacker with local high privileges to cause heap corruption in grub2, potentially leading to arbitrary code execution and bypass of secure boot protections. The vulnerability affects confidentiality, integrity, and availability of the system boot process.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2025-0684 for current remediation guidance.
CVE-2025-0684: Out-of-bounds Write
Description
A flaw was found in grub2. When performing a symlink lookup from a reiserfs filesystem, grub's reiserfs fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the grub_reiserfs_read_symlink() will call grub_reiserfs_read_real() with a overflown length parameter, leading to a heap based out-of-bounds write during data reading. This flaw may be leveraged to corrupt grub's internal critical data and can result in arbitrary code execution, by-passing secure boot protections.
CVSS v3.1
Score 6.4medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in grub2 occurs when performing a symlink lookup on a reiserfs filesystem. The module uses user-controlled filesystem geometry parameters to calculate buffer sizes but fails to properly check for integer overflows. This can cause grub_malloc() to allocate a smaller buffer than expected. Subsequently, grub_reiserfs_read_symlink() calls grub_reiserfs_read_real() with an overflowed length parameter, resulting in a heap-based out-of-bounds write during data reading. Exploitation could lead to corruption of critical grub data and arbitrary code execution, bypassing secure boot.
Potential Impact
Successful exploitation allows an attacker with local high privileges to cause heap corruption in grub2, potentially leading to arbitrary code execution and bypass of secure boot protections. The vulnerability affects confidentiality, integrity, and availability of the system boot process.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2025-0684 for current remediation guidance.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- redhat
- Date Reserved
- 2025-01-23T19:05:34.260Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2025-0684","vendor":"Red Hat"}]
Threat ID: 6868be146f40f0eb72a6ac80
Added to database: 07/05/2025, 05:54:28 UTC
Last enriched: 07/02/2026, 22:14:37 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 137
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.